Skip to content

Latest commit

 

History

History
364 lines (290 loc) · 27.9 KB

README.md

File metadata and controls

364 lines (290 loc) · 27.9 KB
Raw

jupiterone-aws-cloudformation

This project provides instructions to configure the JupiterOne AWS integration. JupiterOne assumes an IAM Role in the target account that has been granted permission to read information from AWS services supported by JupiterOne. Configuring the IAM Role can be accomplished using one of the following methods:

  1. Launch JupiterOne IAM CloudFormation Stack
  2. Launch JupiterOne IAM CloudFormation Stack using the AWS CLI
  3. Create a Role using the AWS Management Console

JupiterOne is also capable of processing CloudTrail events. Sending them to JupiterOne's AWS account requires an EventBridge event rule, which can be configured using one of the following methods:

  1. Launch JupiterOne EventBridge CloudFormation Stack
  2. Launch JupiterOne EventBridge CloudFormation Stack using the AWS CLI
  3. Create an EventBridge Rule using the AWS Management Console

IAM

Supported Services

JupiterOne currently supports the following services:

  • AccessAnalyzer
  • ACM
  • API Gateway
    • API Gateway v1
    • API Gateway v2
  • Autoscaling
  • Backup
  • Batch
  • CloudFormation
  • CloudFront
  • CloudHSM
  • CloudTrail
  • CloudWatch
    • CloudWatch Alarms
    • CloudWatch Events
    • CloudWatch Logs
  • CodeBuild
  • CodeCommit
  • CodePipeline
  • Config
  • DirectConnect
  • DynamoDB
  • EC2
  • ECR
  • ECS
  • EFS
  • EKS
  • ElastiCache
  • ELB
  • EMR
  • ES
  • Firehose
  • Firewall Manager
  • Global Accelerator
  • Glue
  • GuardDuty
  • IAM (including IAM Policy analysis)
  • Inspector
  • Inspector2
  • Kinesis
  • KMS
  • Lambda
  • Lex v2
  • Macie 2
  • Network Firewall
  • Organizations
  • RDS
  • Redshift
    • Redshift Serverless
  • Route53
    • Route53 Domains
  • S3 (including Bucket Policy analysis)
    • S3 Glacier
  • Secrets Manager
  • SES
  • Shield
  • SNS
  • SQS
  • SSM
  • Transfer
  • VPC (including VPC Peering)
  • WAF
  • WAF v2
  • Workspaces

For detailed and specific permissions, see "Specific Permissions Policy" section below.

IAM Role Permissions

The SecurityAudit AWS-managed IAM policy covers many permissions used by JupiterOne and simplifies administration as support for more services is added. However, there are additional permissions, not covered by SecurityAudit, necessary to allow JupiterOne to ingest more information, enabling the platform to provide even more value.

Each of the configuration methods recommends and assumes the use of the SecurityAudit managed policy, though you may decide to build out a single policy based on the information provided here.

In case you don't mind the maintenance work and would prefer to update a hand-crafted policy, an exact policy that includes specific permissions is also provided.

Additional Permissions

Link to Additional Permissions Policy

Launch JupiterOne IAM CloudFormation Stack

Specific Permissions Policy

This policy may be used to provide only exactly the specific permissions currently used by JupiterOne. Using this policy will most certainly require you to update the policy in the future as more APIs are called by JupiterOne.

NOTE: By default, AWS enforces a policy size limit of 6,144 non-whitespace characters. The policy below has been split into multiple statements to stay under the 6,144 non-whitespace character limit. If you have requested a quote increase from AWS, you may be able to consolidate these policies.

Link to Specific Permissions Policy

Launch JupiterOne IAM CloudFormation Stack

IAM CloudFormation with AWS CLI

aws cloudformation create-stack --stack-name JupiterOneIntegration --capabilities CAPABILITY_NAMED_IAM --template-url https://s3.amazonaws.com/jupiterone-prod-us-aws-cloudformation-templates/cloudformation.json

Manual IAM Role Creation with AWS Management Console

From your AWS Management Console, perform the following steps:

  1. Go to IAM > Roles and click Create Role.

  2. Select Another AWS account under Select type of trusted entity.

  3. Enter the following Account ID: <jupiterone_account_id>

  4. Select Require external ID and enter the following External ID: <jupiterone_external_id>

  5. Leave Require MFA unchecked and click Next: Permissions.

  6. Click Create Policy, select the JSON tab, and enter the document content found here: Link to Additional Permissions Policy

  7. Click Review Policy and verify the permissions.

  8. Enter JupiterOneSecurityAudit as the Name and click Create Policy.

  9. Return to the Create Role tab in your browser. Click the Policy table's Refresh Icon.

  10. In the Policy search box, search for SecurityAudit. Select both SecurityAudit and JupiterOneSecurityAudit policies. SecurityAudit is an AWS-managed IAM policy.

  11. With both policies selected, click Next: Review.

  12. Enter JupiterOne as the Role Name, and optionally, enter a description for the Role.

  13. Click Create Role.

  14. In the list of Roles, search for and select the newly created JupiterOne role, and copy the Role ARN. It should be in a format that looks like arn:aws:iam::<your_aws_account_id>:role/JupiterOne.

Events

Supported Events

JupiterOne currently supports the following events:

S3

Event Name Modified Entities _type Modified Relationships _type
CreateBucket aws_s3_bucket
PutBucketAcl aws_s3_bucket aws_s3_bucket_grant
PutBucketEncryption aws_s3_bucket
DeleteBucketEncryption aws_s3_bucket
PutBucketInventoryConfiguration aws_s3_bucket aws_s3_bucket_publishes_inventory_report
PutBucketLifecycle aws_s3_bucket
PutBucketLogging aws_s3_bucket
PutBucketPolicy aws_s3_bucket_policy aws_s3_bucket_has_policy
PutBucketReplication aws_s3_bucket
PutBucketTagging aws_s3_bucket
PutBucketVersioning aws_s3_bucket
PutObjectLockConfiguration aws_s3_bucket
PutPublicAccessBlock aws_s3_bucket

IAM

Event Name Modified Entities _type Modified Relationships _type
CreateAccessKey aws_iam_access_key
CreateGroup aws_iam_group
CreatePolicy aws_iam_policy
CreateRole aws_iam_role
CreateUser aws_iam_user

EC2

Event Name Modified Entities _type Modified Relationships _type
RunInstances aws_instance aws_ec2_has_aws_instance aws_instance_uses_ami aws_instance_uses_key_pair aws_instance_uses_eni aws_resource_has_security_group aws_security_group_protects_resource aws_subnet_has_instance
StartInstances aws_instance
StopInstances aws_instance
TerminateInstances aws_instance
ModifyInstanceAttribute aws_instance aws_resource_has_security_group aws_security_group_protects_resource
CreateFleet aws_instance aws_ec2_has_aws_instance aws_instance_uses_ami aws_instance_uses_key_pair aws_instance_uses_eni aws_resource_has_security_group aws_security_group_protects_resource aws_subnet_has_instance
CreateSecurityGroup aws_security_group aws_ec2_has_aws_security_group
DeleteSecurityGroup aws_security_group
AuthorizeSecurityGroupIngress aws_security_group_rule
RevokeSecurityGroupIngress aws_security_group_rule
AuthorizeSecurityGroupEgress aws_security_group_rule
RevokeSecurityGroupEgress aws_security_group_rule
CreateImage aws_ami aws_ami_contains_snapshot
RegisterImage aws_ami aws_ami_contains_snapshot
ModifyImageAttribute aws_ami
DeregisterImage aws_ami
CreateSnapshot aws_ebs_snapshot aws_ebs_volume_snapshot
CreateSnapshots aws_ebs_snapshot aws_ebs_volume_snapshot
ModifySnapshotAttribute aws_ebs_snapshot
DeleteSnapshot aws_ebs_snapshot

Elastic Load Balancing (ELB)

Event Name Modified Entities _type Modified Relationships _type
CreateLoadBalancer aws_alb aws_elb aws_nlb aws_elasticloadbalancing_has_aws_alb aws_elasticloadbalancing_has_aws_elb aws_elasticloadbalancing_has_aws_nlb aws_vpc_has_load_balancer aws_resource_has_security_group aws_security_group_protects_resource
CreateListener aws_lb_listener aws_load_balancer_has_listener aws_lb_listener_uses_acm_certificate aws_lb_listener_uses_iam_server_certificate
CreateTargetGroup aws_lb_target_group aws_load_balancer_connects_target_group
CreateRule aws_lb_listener_rule aws_lb_listener_has_rule
SetSecurityGroups aws_resource_has_security_group aws_security_group_protects_resource
RegisterTargets aws_load_balancer_connects_target_group

AutoScaling

Event Name Modified Entities _type Modified Relationships _type
CreateAutoScalingGroup aws_autoscaling_group aws_autoscaling_has_aws_autoscaling_group aws_autoscaling_group_uses_launch_template aws_autoscaling_group_has_instance aws_autoscaling_group_uses_launch_config aws_autoscaling_group_uses_policy
UpdateAutoScalingGroup aws_autoscaling_group
DeleteAutoScalingGroup aws_autoscaling_group

RDS

Event Name Modified Entities _type Modified Relationships
CreateDBInstance aws_db_instance aws_rds_has_aws_db_instance aws_rds_cluster_contains_instance aws_rds_parameter_group_in_use aws_security_group_protects_resource aws_resource_has_security_group aws_resource_uses_kms_key aws_vpc_has_db_instance aws_db_instance_uses_secret aws_db_instance_uses_option_group
ModifyDBInstance aws_db_instance aws_rds_has_aws_db_instance aws_rds_cluster_contains_instance aws_rds_parameter_group_in_use aws_security_group_protects_resource aws_resource_has_security_group aws_resource_uses_kms_key aws_vpc_has_db_instance aws_db_instance_uses_secret aws_db_instance_uses_option_group
StartDBInstance aws_db_instance
StopDBInstance aws_db_instance
DeleteDBInstance aws_db_instance
CreateDBCluster aws_rds_cluster aws_rds_has_aws_rds_cluster aws_rds_parameter_group_in_use aws_security_group_protects_resource aws_resource_has_security_group aws_resource_uses_kms_key
ModifyDBCluster aws_rds_cluster aws_rds_has_aws_rds_cluster aws_rds_parameter_group_in_use aws_security_group_protects_resource aws_resource_has_security_group aws_resource_uses_kms_key
StartDBCluster aws_rds_cluster
StopDBCluster aws_rds_cluster
DeleteDBCluster aws_rds_cluster
CreateDBSnapshot aws_db_snapshot aws_db_instance_has_snapshot aws_db_snapshot_uses_kms_key
DeleteDBSnapshot aws_db_snapshot
CreateDBClusterSnapshot aws_db_cluster_snapshot aws_db_cluster_has_snapshot aws_db_cluster_snapshot_uses_kms_key
DeleteDBClusterSnapshot aws_db_cluster_snapshot

Redshift

Event Name Modified Entities _type Modified Relationships _type
CreateCluster aws_redshift_cluster aws_redshift_has_aws_redshift_cluster aws_redshift_cluster_uses_parameter_group aws_security_group_protects_resource aws_resource_has_security_group aws_resource_uses_kms_key aws_vpc_has_redshift_cluster
ModifyCluster aws_redshift_cluster aws_redshift_has_aws_redshift_cluster aws_redshift_cluster_uses_parameter_group aws_security_group_protects_resource aws_resource_has_security_group aws_resource_uses_kms_key aws_vpc_has_redshift_cluster
DeleteCluster aws_redshift_cluster

Events CloudFormation with AWS CLI

aws cloudformation create-stack --stack-name JupiterOneIntegrationEvents --template-url https://s3.amazonaws.com/jupiterone-prod-us-aws-cloudformation-templates/events-cloudformation.json

Events CloudFormation with AWS Management Console

Launch JupiterOne EventBridge CloudFormation Stack

Manual EventBridge Rule Creation with AWS Management Console

From your AWS Management Console, perform the following steps:

  1. Go to Amazon EventBridge > Rules and, with the default event bus selected, click Create rule.

  2. Enter the following values:

    • Name: jupiterone-cloudtrail-events
    • Description: Send CloudTrail Events to JupiterOne

  3. In the Define pattern section, select Event pattern and then Custom pattern. Copy the Resources.JupiterOneCloudTrailEventsRule.Properties.EventPattern object from cloudformation/events/cloudformation-template.json (Link to EventBridge CloudFormation) into the text field. It should look something like this:

    {
  "source": ["aws.s3", "aws.iam", "aws.ec2", "...more sources..."],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": [
      "s3.amazonaws.com",
      "iam.amazonaws.com",
      "ec2.amazonaws.com",
      "...more sources..."
    ],
    "eventName": ["...event names here..."]
  }
}

  4. In the Select targets section, select Event bus in another AWS account. For the Event Bus field, enter arn:aws:events:us-east-1:612791702201:event-bus/jupiter-integration-aws. For the role, select Create a new role for this specific resource.

    The role should have be created with a policy which looks like:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["events:PutEvents"],
      "Resource": [
        "arn:aws:events:<TARGET AWS REGION>:<JUPITERONE ACCOUNT ID>:event-bus/jupiter-integration-aws"
      ]
    }
  ]
}

    and a trust relationship which looks like:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

  5. Click Create.